fix: eliminate runtime require()/exports.foo bombs in ESM modules

The previous merge resolution caught the obvious `require()` calls in
files with conflict markers, but several develop-side files use bare
`require()` or `exports.foo = ...` outside of conflict zones. These
compile fine under tsc (which is permissive about CJS-shape syntax in
ESM modules) but throw at runtime as soon as the module is loaded by
Node's ESM loader: `ReferenceError: require/exports is not defined in
ES module scope`.

That's what the CI surfaced — every job that boots the server or builds
the admin UI (which imports the server modules to dump the OpenAPI
spec) was failing on:
  src/node/utils/Settings.ts:1346  `require('../../package.json')`
  src/node/hooks/express/openapi.ts:874  `exports.generateDefinitionForVersion = ...`

Fixed:
- Settings.ts:1346 — replaced the inline `require(...).version` with the
  existing ESM-safe `getEpVersion()` helper (which already uses the
  module's createRequire bridge on line 884). Same value, no duplication.
- server.ts:193 — `require('./updater')` → `await import('./updater/index.js')`
  for the optional markBootHealthy() call.
- ExportHandler.ts — added a createRequire bridge and replaced the four
  inline `require()` calls (sofficeAvailable, ExportSanitizeHtml,
  html-to-docx, ExportPdfNative) with ESM imports where possible.
- ImportHandler.ts — added static ESM imports for ImportDocxNative and
  ExportSanitizeHtml; dropped the three inline `require()` calls.
- ExportPdfNative.ts, ImportDocxNative.ts — added createRequire bridges
  for the top-level CJS-only npm package requires (pdfkit, mammoth, jszip).
  These packages publish CJS entries that don't round-trip cleanly through
  ESM default-import interop under tsx; the bridge is the minimum-risk fix.
- adminsettings.ts — replaced inline `require('AuthorManager')` with a
  static `import * as authorManager`.
- pad_editbar.ts — replaced `require('./pad_mode')` with `await import(...)`
  inside the showTimeSlider click handler (which is already async-capable).
- openapi.ts:874-875 — `exports.X = X; exports.Y = Y;` → `export {X, Y};`.
- openapi-admin.ts — dropped the redundant `exports.expressPreSession =
  expressPreSession;` (the function is already `export const`) and the
  duplicate `exports.generateAdminDefinition = generateAdminDefinition;`
  (also already `export const` on the declaration line).

Verified locally:
- `pnpm run ts-check` passes.
- `admin/scripts/dump-spec.ts` — the script that booted the failing
  `dump-spec.ts failed with exit code 1` in CI — now runs to completion
  and writes a 128 KB spec.

Author: SamTV12345

src/node/handler/ExportHandler.ts

@@ -20,17 +20,25 @@
  * limitations under the License.
  */
 
+import {createRequire} from 'node:module';
 import * as exporthtml from '../utils/ExportHtml.js';
 import * as exporttxt from '../utils/ExportTxt.js';
 import * as exportEtherpad from '../utils/ExportEtherpad.js';
 import fs from 'fs';
-import settings from '../utils/Settings.js';
+import settings, {sofficeAvailable} from '../utils/Settings.js';
+import * as ExportSanitizeHtml from '../utils/ExportSanitizeHtml.js';
 import os from 'os';
 import hooks from '../../static/js/pluginfw/hooks.js';
 import util from 'util';
 import { checkValidRev } from '../utils/checkValidRev.js';
 import * as converterModule from '../utils/LibreOffice.js';
 
+// Lazy CJS bridge for optional native-export modules (html-to-docx,
+// ExportPdfNative). Loaded at call sites that are gated by sofficeAvailable
+// and require.resolve() probes — keeps the legacy convert path the default
+// and only pulls in the in-process renderers when soffice is unconfigured.
+const require = createRequire(import.meta.url);
+
 const fsp_writeFile = util.promisify(fs.writeFile);
 const fsp_unlink = util.promisify(fs.unlink);
 
@@ -96,7 +104,6 @@ export const doExport = async (req: any, res: any, padId: string, readOnlyId: st
     // hand DOCX to html-to-docx and PDF to our pdfkit walker — both
     // pure-JS, in-process. No fallback chain: native errors surface as
     // 5xx so admins see real failures instead of silent shadowing.
-    const {sofficeAvailable} = require('../utils/Settings');
     const sofState = sofficeAvailable();
     const goNative = sofState === 'no'
         || (sofState === 'withoutPDF' && type === 'pdf');
@@ -105,7 +112,7 @@ export const doExport = async (req: any, res: any, padId: string, readOnlyId: st
       const {
         stripRemoteImages, extractBody, wrapLooseLines, dropEmptyBlocks,
         applyMonospaceToCode,
-      } = require('../utils/ExportSanitizeHtml');
+      } = ExportSanitizeHtml;
       // The HTML pipeline returns a full document (head, style, body); the
       // legacy soffice path renders that fine, but the in-process
       // converters need just the body content to avoid leaking CSS into

src/node/handler/ImportHandler.ts

@@ -30,6 +30,8 @@ import { Formidable } from 'formidable';
 import os from 'os';
 import * as importHtml from '../utils/ImportHtml.js';
 import * as importEtherpad from '../utils/ImportEtherpad.js';
+import * as ImportDocxNative from '../utils/ImportDocxNative.js';
+import * as ExportSanitizeHtml from '../utils/ExportSanitizeHtml.js';
 import log4js from 'log4js';
 import hooks from '../../static/js/pluginfw/hooks.js';
 import * as converterModule from '../utils/LibreOffice.js';
@@ -157,8 +159,8 @@ const performImport = async (req:any, res:any, padId:string, authorId:string) =>
   // through the existing setPadHTML pipeline.
   if (settings.soffice == null && fileEnding === '.docx') {
     const buf = await fs.readFile(srcFile);
-    const {docxBufferToHtml} = require('../utils/ImportDocxNative');
-    const {separateAdjacentHeadingBlocks} = require('../utils/ExportSanitizeHtml');
+    const {docxBufferToHtml} = ImportDocxNative;
+    const {separateAdjacentHeadingBlocks} = ExportSanitizeHtml;
     let nativeHtml: string;
     try {
       nativeHtml = await docxBufferToHtml(buf);
@@ -281,8 +283,7 @@ const performImport = async (req:any, res:any, padId:string, authorId:string) =>
         // Only applied to HTML imports (and converted-via-soffice
         // outputs, which look the same shape) -- the docx native path
         // above doesn't go through here.
-        const {collapseRedundantBrAfterBlocks} =
-            require('../utils/ExportSanitizeHtml');
+        const {collapseRedundantBrAfterBlocks} = ExportSanitizeHtml;
         const cleaned = (fileIsHTML || useConverter)
             ? collapseRedundantBrAfterBlocks(text) : text;
         await importHtml.setPadHTML(pad, cleaned, authorId);

src/node/hooks/express/adminsettings.ts

@@ -11,6 +11,7 @@ import settings, {getEpVersion, getGitCommit, reloadSettings} from '../../utils/
 import {getLatestVersion} from '../../utils/UpdateCheck.js';
 import * as padManager from '../../db/PadManager.js';
 import * as api from '../../db/API.js';
+import * as authorManager from '../../db/AuthorManager.js';
 import {deleteRevisions} from '../../utils/Cleanup.js';
 
 
@@ -308,8 +309,6 @@ export const socketio = (hookName: string, {io}: any) => {
      }
     })
 
-    const authorManager = require('../../db/AuthorManager');
-
     // The admin author-erasure UI (PR #7667) is gated as a single
     // feature: when gdprAuthorErasure.enabled is false, all three
     // socket handlers refuse so the page is fully off by default per

src/node/hooks/express/openapi-admin.ts

@@ -153,8 +153,6 @@ export const generateAdminDefinition = (): any => ({
   },
 });
 
-exports.generateAdminDefinition = generateAdminDefinition;
-
 export const expressPreSession = async (
   _hookName: string,
   {app}: ArgsExpressType,
@@ -179,4 +177,3 @@ export const expressPreSession = async (
   });
 };
 
-exports.expressPreSession = expressPreSession;

src/node/hooks/express/openapi.ts

@@ -871,5 +871,4 @@ const generateServerForApiVersion = (apiRoot:string, req:any): {
   url: `${settings.ssl ? 'https' : 'http'}://${req.headers.host}${apiRoot}`,
 });
 
-exports.generateDefinitionForVersion = generateDefinitionForVersion;
-exports.APIPathStyle = APIPathStyle;
+export {generateDefinitionForVersion, APIPathStyle};

src/node/server.ts

@@ -189,8 +189,7 @@ export const start = async (): Promise<any> => {
   // health signal the updater's pending-verification timer is waiting for.
   // Wrapped in try/catch because it must never block startup on a bug here.
   try {
-    // eslint-disable-next-line @typescript-eslint/no-var-requires
-    const updater = require('./updater');
+    const updater = await import('./updater/index.js');
     if (typeof updater.markBootHealthy === 'function') updater.markBootHealthy();
   } catch (err) {
     logger.debug(`markBootHealthy: ${(err as Error).message}`);

src/node/utils/ExportPdfNative.ts

@@ -1,8 +1,13 @@
 'use strict';
 
+import {createRequire} from 'node:module';
 import {Parser} from 'htmlparser2';
 import {PassThrough} from 'stream';
 
+// CJS bridge for pdfkit — it publishes a CommonJS default export
+// (the PDFDocument constructor) which doesn't round-trip cleanly through
+// ESM default-import interop under tsx.
+const require = createRequire(import.meta.url);
 const PDFDocument = require('pdfkit');
 
 interface InlineState {

src/node/utils/ImportDocxNative.ts

@@ -1,5 +1,10 @@
 'use strict';
 
+import {createRequire} from 'node:module';
+
+// CJS bridge for mammoth + jszip — both publish CommonJS entries and
+// interact poorly with `import` default-export interop under tsx/ESM.
+const require = createRequire(import.meta.url);
 const mammoth = require('mammoth');
 const JSZip = require('jszip');
 

src/node/utils/Settings.ts

@@ -1343,9 +1343,8 @@ export const reloadSettings = () => {
     if (explicit) {
         settings.randomVersionString = explicit;
     } else {
-        const pkgVersion = require('../../package.json').version as string;
         settings.randomVersionString = createHash('sha256')
-            .update(`${pkgVersion}|${settings.gitVersion || ''}`)
+            .update(`${getEpVersion()}|${settings.gitVersion || ''}`)
             .digest('hex')
             .slice(0, 8);
     }

src/static/js/pad_editbar.ts

@@ -517,11 +517,12 @@ const padeditbar = new class {
       padsavedrevs.saveNow();
     });
 
-    this.registerCommand('showTimeSlider', () => {
+    this.registerCommand('showTimeSlider', async () => {
       // Issue #7659: enter history in-place rather than navigating away. The
       // PadModeController owns the iframe lifecycle, banner, and URL hash.
       try {
-        require('./pad_mode').padMode.enterHistory();
+        const {padMode} = await import('./pad_mode.js');
+        padMode.enterHistory();
       } catch (_e) {
         // Fallback for the unlikely case the controller failed to load.
         document.location = `${document.location.pathname}/timeslider`;